CVE-2023-50968

CVSS V2 None CVSS V3 None
Description
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Overview
  • CVE ID
  • CVE-2023-50968
  • Assigner
  • apache
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-12-26T11:45:55.393Z
  • Last Modified Date
  • 2023-12-26T11:45:55.393Z
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CWE-918 http://cwe.mitre.org/data/definitions/918.html
References
Reference URL Reference Tags
https://ofbiz.apache.org/download.html mitigation
https://ofbiz.apache.org/security.html related
https://ofbiz.apache.org/release-notes-18.12.11.html release-notes
https://issues.apache.org/jira/browse/OFBIZ-12875 issue-tracking
https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q vendor-advisory
http://www.openwall.com/lists/oss-security/2023/12/26/2
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-50968
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50968
History
Created Old Value New Value Data Type Notes
2024-06-25 18:43:55 Added to TrackCVE